Print My Blog – Print, PDF, & eBook Converter <= 3.15.8 - Unprotected AJAX Actions
Strategic Overview
<= 3.15.8N/AVulnerability Overview
The Print My Blog – Print, PDF, & eBook Converter plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions hooked via AJAX actions in versions up to, and including, 3.15.8. This makes it possible for authenticated attackers with subscriber-level permissions and above to modify the plugin's settings and inject malicious JavaScript. The affected AJAX actions are: wp_ajax_pmb_save_project_main, wp_ajax_pmb_post_search, wp_ajax_pmb_add_print_material, wp_ajax_pmb_reduce_credits, wp_ajax_pmb_report_error, and wp_ajax_pmb_duplicate_print_material. This could also be exploited via Cross-Site Request Forgery.
Technical Analysis
REMEDIATION: Update to version 3.15.9, or a newer patched version --- IDENTIFIER: CWE-862 (Missing Authorization) The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C